Potential Defense Evasion Via Rename Of Highly Relevant Binaries

detection:
  filter:
    Image|endswith:
      - '\certutil.exe'
      - '\cmstp.exe'
      - '\cscript.exe'
      - '\ie4uinit.exe'
      - '\finger.exe'
      - '\mshta.exe'
      - '\msiexec.exe'
      - '\msxsl.exe'
      - '\powershell_ise.exe'
      - '\powershell.exe'
      - '\psexec.exe'
      - '\psexec64.exe'
      - '\psexec64a.exe'
      - '\PSEXESVC.exe'
      - '\pwsh.exe'
      - '\reg.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
      - '\wermgr.exe'
      - '\wmic.exe'
      - '\wscript.exe'
  selection:
    - Description: 'Execute processes remotely'
    - Product: 'Sysinternals PsExec'
    - Description|startswith:
        - 'Windows PowerShell'
        - 'pwsh'
    - OriginalFileName:
        - 'certutil.exe'
        - 'cmstp.exe'
        - 'cscript.exe'
        - 'IE4UINIT.EXE'
        - 'finger.exe'
        - 'mshta.exe'
        - 'msiexec.exe'
        - 'msxsl.exe'
        - 'powershell_ise.exe'
        - 'powershell.exe'
        - 'psexec.c'
        - 'psexec.exe'
        - 'psexesvc.exe'
        - 'pwsh.dll'
        - 'reg.exe'
        - 'regsvr32.exe'
        - 'rundll32.exe'
        - 'WerMgr'
        - 'wmic.exe'
        - 'wscript.exe'
  condition: selection and not filter

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Matthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

The commands LOLBAS or GTFOBins documents for winrm.vbs trip it: each is on its program’s page, read by CmdID.